Julián de Navascués wrote:
[...]
> Is the sshd able to recieve a info message from PAM (as a PAM aware
> app in a PAM conversation) and send it immediately to the SSH client
> (as a SSH server in the middle of a keyboard interactive
> authentication) ???


It should, but having said that it would only work for
keyboard-interactive and PAM can be invoked for other auth types
(password, for the auth stack or any, for the account stack). Banner
messages can be sent at any time before authentication is complete
(that's why they're used for this).

> Has anybody did this before? I know it sounds complicated or even
> absurd, but we want it (and we dont want to patch SSH server or
> client).

[...]

I will look at this but it would be easier if you can supply the output
from the diag tool I asked for:

> Could you please you compile and run (as root) this little test program
> to show what PAM's doing and post the output? (Sanity checking the code
> first is recommended. It doesn't set noecho so you want to make sure
> there's nobody watching over shoulders, and obviously clip any sensitive
> bits from the output.)
>
> http://www.zip.com.au/~dtucker/patch...test-harness.c


(addendum: if the timing is important to you please add the -v option to
enable timestamps)

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/li...enssh-unix-dev